I am working on a legacy project containing many jsps and models. Lot of places, people have used @ModelAttribute to map the request parameters to the specific model class.

My question is, in the conversion of request params to model, does spring internally invoke request.getParameter() method? I want to prevent XSS and already have XSS filter in place. But during request params to model conversion, I don't see control coming to my overriden getParameter() mthod.

CodePudding user response：

For binding Spring has the DataBinder abstraction, for a web request that utilizes the ServletRequestDataBinder. If you take a look at the source code you will end up here which shows a call to WebUtils.getParametersStartingWith.

If you look at the last code you will see that it uses getParameterNames and getParameterValues instead of getParameter.